feat(argocd): deploy SOPS CMP plugin for secret decryption — Stage 0 grafana

Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts
*.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets.

Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates
grafana-values.yaml to wire admin.existingSecret (chart-native support).

CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik.
Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4
(loki/authentik/forgejo/temporal) extend plugin script incrementally after
verification.

Co-Authored-By: Claude Haiku 4.5 <[email protected]>

k8s/platform/logging/grafana-values.yaml

@@ -2,8 +2,8 @@
 # Grafana — dashboarding and log/metrics exploration UI.
 # Deployed in the logging namespace alongside Loki and Promtail.
 #
-# Secrets never set here:
-#   adminPassword        — injected via helmfile --set (GRAFANA_ADMIN_PASSWORD)
+# Secrets provided by ArgoCD SOPS CMP plugin:
+#   adminPassword        — mounted from the grafana-admin K8s Secret (admin.existingSecret)
 #   OAuth client secret  — mounted from the grafana-oidc K8s Secret (envFromSecret below)
 
 replicas: 1
@@ -14,9 +14,12 @@ deploymentStrategy:
   type: Recreate
 
 podAnnotations:
-  secret.reloader.stakater.com/reload: "grafana-oidc"
+  secret.reloader.stakater.com/reload: "grafana-oidc,grafana-admin"
 
 adminUser: admin
+admin:
+  existingSecret: grafana-admin
+  existingSecretKey: admin-password
 
 resources:
   requests: